Displays in Google Authenticator

[copenhaus]

Hi.

When I snap the barcode with my Google Authenticator, on the bottom it displays the Federated Cloud ID.

If I were to setup/enable 2FA settings on multiple accounts on my Google Authenticator, I can't tell the differences...

Can the display of Federated Cloud ID be changed to username?

Thanks....

[ChristophWurst]

What does your federated cloud ID look like? I chose to use it because it's pretty unique, also if you're using many NC accounts.

[copenhaus]

12345678-1234-4321-9257-FDFA5F682041@cloud.company.com...to me, it's like going to a website using its IP address (http://88.198.160.129), instead of FQDN (http://www.nextcloud.com)...IMHO...

[ChristophWurst]

Ouch. I guess that's not the login name you're using to log on, is it? Does your instance use LDAP as user backend? I wonder where that long username comes frome …

[copenhaus]

yes, my NC is integrated with Windows AD through LDAP.

[ChristophWurst]

@blizzz any idea whether the federated cloud id should look like this when using an LDAP back end or this is caused by misconfiguration?

[mddeff]

@copenhaus As a work around, you could switch to FreeOTP (rather than Google Auth) for your TOTP client; it allows you to rename the metadata fields on each OTP entry. Also, FreeOTP is FOSS (written by RedHat/Fedora), where as I believe Google Auth is closed source (or what they have open-sourced is out of date), and is available on iOS and Android (one less userguide to write for your users ;-) ).

Not a permanent solution, but at least it helps. I'd be interested to see the resolution, I'm seeing the same behavior,

[blizzz]

@blizzz any idea whether the federated cloud id should look like this when using an LDAP back end or this is caused by misconfiguration?

@ChristophWurst federated cloud it is always username@server and by default usernames are created of the UUID of the LDAP record, so, yes, this looks correct.

However, I believe we have a dirty hack in place that allows you to use your loginname instead, and it will be transformed by the server… but this is very dirty, very ugly 🙊

[ChristophWurst]

Labeling as enhancement because this only effects the name of the secret in your smartphone's app. The TOTP functionality should not be effected.

[nursoda]

When you're serious about 2FA/TOTP, use Mufri's "Authenticator Plus" (paid) app. You may change icons, label, overall look, add another security layer accessing TOTP (e.g. using Fingerprint), etc. and it can BACKUP all your secrets (complete config), so that you may reinstall on another phone. (Well, backup is important if you do NOT use a rooted phone.

[ernolf]

Anyone who needs this feature; this is solved in twofactor_oath, a separate OATH provider app with TOTP functionality (besides HOTP and OCRA)

https://github.com/ernolf/twofactor_oath

Since v0.3.0 the provisioning label falls back to the email address when the user ID is an opaque identifier (the guests app's SHA-256 email hash or an LDAP UUID), and the label can also be edited right next to the QR code before scanning. So every account gets a short, recognizable name in the authenticator app, no matter what the user backend does to the user ID.

h.t.h.

ernolf